help with routing over ipsec vpn

[jpbody]

I am hoping somebody can help me out with this.  I have a client with a fortigate 60D I have it setup with remote access ipsec vpn's using the forticlient software to for clients to connect to router.  This is at a law enforcement site so there is another router on this network that goes out to the Florida Department of Law Enforcement (FDLE).  I have the ipsec vpn connected and can see the internal network and I have route static route statements in the fortigate to route internal network to the FDLE router and that works great I just need to get the ipsec vpn clients to send certain subnet requests over the vpn besides just the internal network subnets.  So the question is how do I get the clients to send other subnets over the vpn connection along with the internal network requests?

Thank you

Jason 

[tputterman · Accepted solution]

You need to add these other subnets to your local subnets for the VPN tunnel config.

This would be under the Accessible networks section of your IPSec Config.

This should be an address group object, Default is usually tunnelname_Local_Subnet. Create new address object and add it to the local_subnet object, or whatever you have it called.

From there you would need to have firewall policies in place to allow that traffic in on the tunnel and out to wherever it needs to route to. Routing policies would also be needed to route to that other router(I assume this is already in place) put the correct interface.

Depending on what you are doing with Nat, you also may need to have routing policies on the other router to route the traffic back to your Fortigate. The VPN traffic is going to be a different IP range. Personally I don't like to nat anything internal, but you would need to have control of the other router to ensure the traffic is routed back to the fortigate for the VPN tunnel.

Thanks

Greg

[jpbody]

Thank you very much.  With what you told me I had the networks added to the accessible networks already but what I did not do was go in the firewall rule for the remote vpn connection and add the other network in there for the destination networks so it is working great now.  So again thank you very much for the help